Spot the red flag
Twenty scenarios drawn from real enforcement patterns. Pick an answer to see the explanation, and the technique page behind it.
-
A customer withdraws $50,000 in cash. The bank asks routine questions. The following month, the same customer makes six withdrawals of $9,500 over two weeks.
What should the bank do?
Shrinking withdrawals to just under the threshold right after being asked about a large one is the classic structuring pattern. It is the exact sequence that led to Dennis Hastert's conviction. SARs have no need for a threshold when the conduct itself is suspicious.
-
A small-town car wash reports revenue triple that of comparable businesses, stays flat through winter, and buys almost no soap or supplies relative to its claimed volume.
What's the red flag pattern?
Revenue out of line with peers, no seasonality, and supplier purchases too small for claimed sales are the signature of a cash-intensive front: the register records money that no customer ever spent.
-
A casino patron buys $80,000 of chips with bundled $20 bills delivered to the parking lot by a third party, plays a few hands of baccarat, and cashes out.
Why does this pattern matter?
Large cash buy-ins with little play, third-party cash drops, and bills bundled street-style were exactly what BC's Cullen Commission documented. The casino's cheque or chips give the cash a respectable origin story.
-
A student's checking account starts receiving e-transfers from a dozen strangers across the country, each forwarded within hours to an overseas account, keeping a small percentage.
What is the account holder acting as?
Inflows from many unrelated sources with rapid onward transfers, inconsistent with the holder's profile, is the mule pattern. Many mules are recruited through job ads or romance scams and keep a cut per transfer.
-
A company with no website, no staff, and a registered address shared with 4,000 other firms receives $8 million in 'consulting fees' and forwards it to a similar company in another jurisdiction within days.
What structure is this?
No operations, a mass registered-agent address, vague service labels, and pass-through flows are shell-company layering; each hop adds a jurisdiction an investigator must subpoena.
-
An exporter invoices 10,000 phone cases at $90 each to a related buyer abroad; identical cases sell wholesale for $9. The goods ship; the payment clears through trade finance.
What just happened?
Invoicing at ten times market price moves $810,000 of value under cover of commerce: over-invoicing, the core trade-based laundering move. Banks process the documents; almost no one reconciles price to market.
-
A US electronics wholesaler is paid for a Colombian client's order by three cashier's cheques from unrelated US individuals and a cash deposit made directly into its account by a stranger.
What system is the wholesaler brushing against?
Third-party payments from unrelated people on behalf of a Latin American importer is the BMPE signature: a peso broker is paying the exporter with a cartel's US cash while the importer pays pesos at home.
-
Two import businesses in different countries wire each other round sums monthly labelled 'settlement,' with no goods moving. Each also hands out local cash to walk-in customers referred by phone.
What are these businesses likely operating as?
Cash paid out on instruction with periodic netting wires between apparently unrelated firms is how hawala-style networks settle. The individual transfers never touch a wire; only the aggregate does.
Read the full explainer: Hawala and informal value transfer →
-
Minutes after a $40 million exchange hack, the stolen crypto splits across hundreds of addresses, converts to ether, crosses two bridges to other blockchains, and lands in a no-KYC swap service.
What is the goal of all that movement?
Rapid post-hack splitting, chain-hopping, and no-KYC swaps are about fragmenting the ledger trail across systems no single tool watches end to end. It is the pattern Lazarus Group runs at billion-dollar scale.
Read the full explainer: Chain-hopping and cross-chain bridges →
-
A wallet with no business history receives millions in dollar-pegged stablecoins from hundreds of small wallets, then moves the balance to an over-the-counter broker advertising 'cash settlement, no questions.'
What stage of laundering is this wallet performing?
Aggregating victim-sized inflows into USDT and cashing out through a no-KYC OTC broker is the standard scam-economy pipeline, the pattern behind the Huione Guarantee marketplace that FinCEN cut off from the US system.
-
An importer in one country pays US$38 per unit for plastic buckets that the same supplier lists to other buyers at US$4. Customs paperwork matches the invoice; the goods are ordinary.
What is the most likely concern?
Paying far above market price for ordinary goods lets the exporter receive more than the goods are worth. The surplus is the real transfer. Trade compliance teams compare invoice prices with market benchmarks for exactly this reason.
-
A small remittance shop's customers each hand over cash and give a phone number. The shop never wires money abroad on those days, yet its overseas counterpart pays out to recipients within hours.
What system is the shop probably part of?
Value moves on trust and later net settlement rather than by wire. Most hawala is legitimate remittance, but an unregistered operator whose settlement does not match its declared flows is a regulator's concern.
Read the full explainer: Hawala and informal value transfer →
-
A respondent bank in a small jurisdiction opens a dollar account at a large correspondent bank. Within months it is sending thousands of wires a day, and some of its own customers are other banks the correspondent has never vetted.
What risk is the correspondent bank facing?
When a respondent serves other banks or services, the correspondent sees only the respondent, not the layers behind it. Enhanced due diligence on the respondent's own customer base is the standard control.
Read the full explainer: Correspondent banking and wire layering →
-
A crypto kiosk operator notices that one phone number is linked to dozens of different people using the same machine in a week, many of them older customers who say they were told to 'move savings to a safe wallet'.
What is the pattern?
Many unrelated users, repeated wallet destinations, and customers following a script point to fraud proceeds being collected through the kiosk. Operators are expected to monitor and report this.
Read the full explainer: Crypto ATMs and peer-to-peer trades →
-
An analyst traces stolen funds that split into dozens of wallets, are swapped through a bridge to a different blockchain, then recombine at an exchange that has no identity checks.
What is the investigator looking at?
Moving across chains and splitting funds is meant to slow tracing. Analytics firms follow bridge contracts and cluster addresses, and the cash-out point at a service with weak identity checks is often where the trail is picked up.
Read the full explainer: Chain hopping and cross-chain bridges →
-
A buyer pays all cash for a luxury apartment through a newly formed company whose ownership papers name only a nominee director. The buyer lives abroad and never visits the property.
What should the lawyer or agent do?
All-cash purchases through opaque companies are a core real-estate red flag. Professionals are expected to look through the vehicle to the person who really owns it and to understand where the money came from.
-
A jewellery dealer buys gold from several cash sellers with no paperwork, melts it into bars, and sells the bars to a refiner abroad, booking all of it as ordinary trading profit.
Why is this attractive to launderers?
Gold is portable, universally accepted, and once melted it cannot be traced to its source. That is why dealers and refiners are expected to know their suppliers and the origin of the metal.
-
A customer repeatedly loads prepaid cards with cash just under the issuer's identification limit, then hands the cards to other people who cash them out at ATMs in another country.
What does this look like?
Loads kept just below the identification limit, repeated across many cards and followed by overseas cash-outs, are the signature that issuers monitor for. The card carries value without a bank account.
-
A homeowner expecting a family transfer from abroad finds their account credited with ten small cash deposits made at different branches by people they have never met, matching the expected amount.
What is likely happening?
Criminal cash is deposited into an unwitting recipient's account while the real transfer stays offshore. The recipient usually sees only the expected amount. Banks compare unusual third-party cash deposits with remittance records.
-
A law firm's client account receives a large sum from a third party with no matching legal work, and the client then asks the firm to pay it out to a different company within days.
What is the red flag?
Funds that enter and leave without legal work give the transfer the appearance of a professional's involvement. Supervisors and banks look for client accounts used as pass-through accounts.